1. Field of the Invention
This invention relates to software systems for managing data and documentation for projects in regulated industries such as the pharmaceutical and biomedical fields, biomedical data gathering and the like and, more particularly, relates to the verification and validation requirements for such software systems.
2. Description of Related Art
Software systems that are designed to manage data and documentation for projects that require regulatory review and approval must be certified as accurate and reliable, so that the regulatory examiners can be assured that the data is sound and the requested regulatory action is factually justified. An example of this is the software systems used to manage and control studies and trials for biomedical purposes, such as US FDA drug or new device trials. The software system must be validated under an approval process that is described below.
Software verification provides objective evidence that the design outputs of a particular phase of the software development life cycle meet all of the specified requirements for that phase. Software verification looks for consistency, completeness, and correctness of the software and its supporting documentation, as it is being developed, and provides support for a subsequent conclusion that software is validated. Software testing is one of many verification activities intended to confirm that software development output meets its input requirements. Other verification activities include various static and dynamic analyses, code and document inspections, walkthroughs, and other techniques.
Software validation is the process of building quality into a software system to ensure the reliability of software applications and integrity of electronic records that resides in the application. Software validation is a part of the design validation for a finished application, but is not separately defined in the Quality System regulation. For purposes of this guidance, FDA considers software validation to be “confirmation by examination and provision of objective evidence that software specifications conform to user needs and intended uses, and that the particular requirements implemented through software can be consistently fulfilled.” In practice, software validation activities may occur both during, as well as at the end of the software development life cycle to ensure that all requirements have been fulfilled. Since software is usually part of a larger hardware system, the validation of software typically includes evidence that all software requirements have been implemented correctly and completely and are traceable to system requirements. A conclusion that software is validated is highly dependent upon comprehensive software testing, inspections, analyses, and other verification tasks performed at each stage of the software development life cycle. Testing of device software functionality in a simulated use environment, and user site testing are typically included as components of an overall design validation program for a software automated device. For the purposes of this document, the terms validation and verification are used interchangeably.
Current Validation Process for Software Systems
1. Software COTS Applications are developed and tested by the vendor using SDLC in the vendor's standard development environment (of servers, database, operating systems for each piece of hardware, ancillary software, etc.).
2. Different sponsors use different environments; e.g., different versions of Oracle v9i, v10, or different operating systems; e.g., Solaris, Linux, Windows 2000, Windows XP, so the vendor will then test the same application in the sponsor environments that the vendor supports—typically the vendor will support versions of the last 2-3 years and then will drop support. This means the application is tested as a system.3. The vendor will then sell the application (NOT the system) to the sponsor.4. Before purchasing the application the sponsor may choose to audit the vendor to ensure that good software engineering practices have been used for the development of the application.5. The sponsor will then deploy the application based on the sponsor's environment, by assembling/installing the other components, such as hardware, database, ancillary software, etc, to create the computer system and then test the system in the sponsor environment, and by configuring the application by entering the values for the pre-populated lists of the application; e.g., species, race, gender, sample type (blood, urine, etc.) location, etc. Several steps are involved in this as the hardware, software and ancillary software comes from different vendors, such as Oracle, MS, Sun, HP, and the application vendor. The process of ensuring that the application functions correctly in the sponsor environment and meets the sponsor requirements is the practical implementation of the validation process.6. Validation at the sponsor site can take between 6 months to 2 years or more (elapsed—not person-time) for a new application, incurring significant validation costs rates that range from tens of thousands to hundreds of thousands to millions of dollars per month.7. Upgrade and revalidation of the system is required by the sponsor as the vendors of different system components stop supporting older versions of some of the components. Upgrade and revalidation at the sponsor site can take many months.8. A typical pharmaceutical/biomedical company may have 30-40 applications that require validation/revalidation.